Is there a patch available for CVE-2026-59253?

Yes, a patch is available for CVE-2026-59253. Update the affected software to the latest version immediately.

n8n CVE-2026-59253

Q: What is the CVSS score of CVE-2026-59253?

CVE-2026-59253 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42268 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-08 disclosure@vulncheck.com

GHSA-gqcv-rfj6-r29g

GHSA-2xgm-wc4g-5jvg

Authentication Bypass N8n

5.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network-accessible, authenticated (PR:L), no UI required; scope changes (S:C) because the attacker's actions corrupt another project's folder structure beyond their own security domain; integrity-only impact (I:L), no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 15:18 vuln.today

Patch available

Jul 08, 2026 - 15:01 EUVD

DescriptionCVE.org

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

AnalysisAI

Improper authorization in n8n before 2.28.0 enables authenticated users to assign workflows to folders belonging to foreign projects by supplying crafted payloads during workflow creation. The flaw (CWE-639) bypasses project and folder ownership checks entirely, allowing logical integrity violations across organizational boundaries in multi-project deployments. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis, though the vendor has released a fix in version 2.28.0.

Technical ContextAI

n8n is an open-source workflow automation platform that organizes automation workflows into projects and folders, a structure critical to multi-tenant or team-based deployments. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): during workflow creation, the API endpoint accepts a folder assignment payload referencing a folder ID without verifying whether that folder belongs to a project the requesting user is authorized to access. Because the key (folder ID) is user-controlled and not server-side validated against the caller's project membership, any authenticated user with workflow creation rights can reference arbitrary folder IDs across project boundaries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms this is a network-accessible, low-complexity flaw exploitable by any low-privileged authenticated user without special preconditions. The affected range spans all n8n versions from 0 up to 2.28.0 per EUVD-2026-42268.

RemediationAI

Upgrade n8n to version 2.28.0 or later, which resolves the missing authorization check on folder assignment during workflow creation. The vendor-confirmed patch is documented in the GitHub Security Advisory GHSA-2xgm-wc4g-5jvg at https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg. If immediate upgrade is not feasible, restrict workflow creation rights to the minimum necessary set of users, reducing the pool of accounts that could exploit the flaw - note this may impact legitimate automation operations. Additionally, audit existing workflows for any cross-project folder assignments that should not exist, as the patch will not retroactively remediate already-corrupted folder structures. No specific port blocking or network-layer mitigation is effective given that the flaw is in application-layer authorization logic.